🛡️ CVE-2025-40068 — kernel

fs: ntfs3: Fix integer overflow in run_unpack()

In the Linux kernel, the following vulnerability has been resolved:

fs: ntfs3: Fix integer overflow in run_unpack()

The MFT record relative to the file being opened contains its runlist,

an array containing information about the file's location on the physical

disk. Analysis of all Call Stack paths showed that the values of the

runlist array, from which LCNs are calculated, are not validated before

run_unpack function.

The run_unpack function decodes the compressed runlist data format

from MFT attributes (for example, $DATA), converting them into a runs_tree

structure, which describes the mapping of virtual clusters (VCN) to

logical clusters (LCN). The NTFS3 subsystem also has a shortcut for

deleting files from MFT records - in this case, the RUN_DEALLOCATE

command is sent to the run_unpack input, and the function logic

provides that all data transferred to the runlist about file or

directory is deleted without creating a runs_tree structure.

Substituting the runlist in the $DATA attribute of the MFT record for an

arbitrary file can lead either to access to arbitrary data on the disk

bypassing access checks to them (since the inode access check

occurs above) or to destruction of arbitrary data on the disk.

Add overflow check for addition operation.

Found by Linux Verification Center (linuxtesting.org) with SVACE.